{"id":2115,"date":"2026-07-30T16:36:25","date_gmt":"2026-07-30T16:36:25","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=2115"},"modified":"2026-07-30T16:36:25","modified_gmt":"2026-07-30T16:36:25","slug":"ai-powered-hacking-370-chrome-flaws-sonicwall-attacks-dns-hijacking-22-more-stories","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=2115","title":{"rendered":"AI-Powered Hacking, 370 Chrome Flaws, SonicWall Attacks, DNS Hijacking + 22 More Stories"},"content":{"rendered":"
\n

\ue804<\/i>Ravie Lakshmanan<\/span>\ue802<\/i>Jul 30, 2026<\/span><\/span>Hacking News \/ Cybersecurity News<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

A lot of security still comes down to trusting the wrong screen.<\/p>\n

This week, that screen might be a login page, an install guide, a recruiter call, or a familiar service behaving slightly wrong. Behind it: reused credentials, exposed systems, quiet loaders, abused trust, and exploit paths that should have been harder.<\/p>\n

Some defenses improved. The loose parts still got found first. Anyway, here’s the mess.<\/p>\n

\n <\/p>\n

The threats change every week. Subscribe, and we\u2019ll alert you<\/span> when each new ThreatsDay Bulletin is out.<\/p>\n<\/div>\n

\n
\n
    \n<\/p>\n
  1. \n <\/p>\n
    \n Phishing delivers XWorm<\/span><\/p>\n

    \n A cybercrime group known as xplogs22 has been observed <\/a> targeting Russia and other CIS countries with phishing emails that deliver Xworm. The group, per F6, is believed to have been active since November 2023. Prior attacks mounted by the threat actors leveraged Formbook and Snake Keylogger, before switching to XWorm around July 2025. In recent months, Russian customers of the banking sector have also been targeted by an Android trojan called LunaSpy <\/a> as part of social engineering attacks. LunaSpy can capture camera streams, record audio and the screen, and collect sensitive data. The malware is disguised as an antivirus application to evade detection.\n <\/p>\n<\/p><\/div>\n<\/li>\n

  2. \n <\/p>\n
    \n Custom ransomware targets Russia<\/span><\/p>\n

    \n The financially motivated extortion group known as Toy Ghouls (aka Bearlyfy and Labubu) has targeted organizations in the Russian Federation, primarily in the manufacturing, financial services, retail, and technology sectors, with a custom ransomware family called GenieLocker since March 2026. According to Kaspersky, the group previously relied on third-party encryptors like RedAlert, LockBit, and Babuk. \u00abGenieLocker, apparently a custom design, upgrades their toolkit and reduces their reliance on third-party software,\u00bb Kaspersky said<\/a>. In at least one case, initial access to the target environment was obtained via an OpenVPN connection originating from an external partner’s network, with the attackers likely exploiting the trusted relationship to breach the target, conduct reconnaissance, deliver additional tools for credential harvesting, and perform lateral movement via RDP and SSH to reach other Windows and Linux hosts. \u00abDuring the impact phase, the attackers encrypted files on the compromised Windows machines with the PE version of the GenieLocker ransomware,\u00bb Kaspersky said. \u00abOn the compromised Linux and ESXi servers, they stopped active virtual machines and encrypted their disks using the ELF version of GenieLocker.\u00bb Details of the activity were first highlighted by F6 in March 2026.\n <\/p>\n<\/p><\/div>\n<\/li>\n

  3. \n <\/p>\n
    \n Crypto-stealing payloads deployed<\/span><\/p>\n

    \n The malware loader known as CastleLoader, which has been previously used to deliver CastleStealer and a Python-based remote access trojan<\/a> (RAT) via ClickFix-style lures, has now been used to distribute two payloads tied to the Needle Stealer framework: a Rust-based desktop wallet spoofer, and a Golang-based malicious browser extension installer. Arctic Wolf said<\/a> it also identified a new shellcode loader variant spreading via digitally signed installers. The campaign has been codenamed Noidret. The introduction of these new tools is seen as an attempt to focus on cryptocurrency-specific targeting and establish browser-level persistence.\n <\/p>\n<\/p><\/div>\n<\/li>\n

  4. \n <\/p>\n
    \n Fileless WebDAV execution<\/span><\/p>\n

    \n Speaking of ClickFix, CyberProof said it tracked a ClickFix variant that involves tricking victims into pasting a single command into the Windows Run dialog, which then communicates with a WebDAV endpoint and uses rundll32.exe to load a remote, non-DLL payload and call its first export by ordinal without having to leave any artifacts on disk. \u00abThe payload (gc.key, j.pm, or goog.ct) is a file served from the attacker WebDAV share and is not a standard DLL by extension,\u00bb CyberProof said<\/a>. \u00abIt is invoked by rundll32.exe through ordinal #1, which runs its primary routine while keeping the export name off the command line.\u00bb\n <\/p>\n<\/p><\/div>\n<\/li>\n

  5. \n <\/p>\n
    \n Fake Claude guide spreads malware<\/span><\/p>\n

    \n Victims searching Google for how to install Claude on a Mac are being served sponsored results that lead them to a weaponized claude.ai\/share conversation dressed up as an Apple Support install guide. The \u00abguide\u00bb instructs them to open Terminal and paste a single curl command, ultimately leading to execution of MacSync Stealer. \u00abMacSync is a six-stage kill chain, not a smash-and-grab,\u00bb Huntress said<\/a>. \u00abThe components are a thin zsh loader, a server-side AppleScript stealer that keeps the valuable logic off the endpoint and behind an api-key gate, a native Mach-O RAT for hands-on access, a separately signed helper built to steal a single TCC permission (Screen Recording), and a set of wallet-app trojans. Each stage sets up the ones that follow.\u00bb\n <\/p>\n<\/p><\/div>\n<\/li>\n

  6. \n <\/p>\n
    \n Malware, intrusions, and influence ops<\/span><\/p>\n

    \n A Russian-speaking threat group is said to be behind an active campaign called Operation STANDOFF that combines commodity-malware distribution, a proxy-botnet that conscripts victims into relay infrastructure, targeted hands-on-keyboard intrusion of enterprise networks, and an AI-driven, multi-channel influence and engagement-manipulation capabilities under one roof. \u00abThe operation is materially more than a botnet,\u00bb VMRay Labs said<\/a>. \u00abIt couples automated, scaled cybercrime with hands-on-keyboard, targeted intrusion and a coordinated influence capability, all on the same infrastructure and built by a common development team.\u00bb The influence apparatus uses networks of fake Telegram accounts and AI-generated personas to artificially boost the visibility of content, push commercial promotions, and drive traffic to gambling and fraud-adjacent services. The activity uses a pay-per-install (PPI) loader masquerading as software installers that delivers Raccoon Stealer, RedLine, Amadey, SmokeLoader, Socelars, Glupteba, and XMRig cryptocurrency miner, while a second, targeted operations layer relies on a bespoke, multi-operator command-and-control console through which human operators conduct hands-on-keyboard intrusions of selected victims.\n <\/p>\n<\/p><\/div>\n<\/li>\n

  7. \n <\/p>\n
    \n Fleet takeover flaw exposed<\/span><\/p>\n

    \n Security researcher Eaton Zveare has disclosed details of a vulnerability in My Eicher, a fleet management system developed by the Volvo Group and Eicher Motors for Indian commercial vehicle customers, that enabled the discovery of unauthenticated internal and. admin APIs that could be exploited to gain high-level access to systems and even enable account takeover. \u00abAccount takeover made it possible to gain control over a person’s (or company’s) entire fleet, which could consist of hundreds of vehicles,\u00bb Zveare said<\/a>. Following responsible disclosure on November 3, 2025, the issue was addressed at some point by November 20.\n <\/p>\n<\/p><\/div>\n<\/li>\n

  8. \n <\/p>\n
    \n AI agents automate exploitation<\/span><\/p>\n

    \n A Chinese-speaking threat actor has been carrying out an AI-enabled autonomous hacking campaign, targeting infrastructure using seven vulnerabilities in Langflow (CVE-2026-33017), n8n (CVE-2026-21858, CVE-2025-68613), Citrix NetScaler (CVE-2026-3055), Apache Tomcat (CVE-2026-34486), Marimo Notebook (CVE-2026-39987), Palo Alto Networks PAN-OS (CVE-2026-0300), and Microsoft Windows IKE Extensions (CVE-2026-33824). The actor, operating under the aliases knaithe and KnYuan, has leveraged DeepSeek, via the Hermes Agent framework, as their autonomous offensive operator, while orchestrating the operation through Telegram to enumerate targets, source exploit tools, and initiate attacks without human intervention. \u00abHermes Agent provided orchestration (terminal access, Telegram-based command and control, and the skills system) while DeepSeek served as the reasoning engine for code generation, vulnerability assessment, target selection and decision-making,\u00bb Unit 42 said<\/a>. Additionally, the threat actor is said to have used Claude Code, Codex, and Qwen Code in a limited capacity. \u00abWhen initial exploitation failed due to the target environment’s restrictive configurations, their Hermes Agent autonomously conducted searches for known critical-severity Common Vulnerabilities and Exposures (CVEs),\u00bb Unit 42 said. \u00abIt initially surveyed 10 product families, scanning GitHub for trending proofs of concept (PoCs) and prioritizing vulnerabilities by attack surface.\u00bb\n <\/p>\n<\/p><\/div>\n

    \"\"<\/a><\/div>\n<\/li>\n
  9. \n <\/p>\n
    \n Trusted access fuels cryptomining<\/span><\/p>\n

    \n Details have emerged about a covert Linux XMRig campaign that exploits trusted access, and weaponizes Pluggable Authentication Modules (PAM) to create a forensic smokescreen and deploy a highly customized XMRig botnet implant. \u00abInitial access was achieved by exploiting a trusted third-party relationship, highlighting critical supply chain risks,\u00bb Group-IB said<\/a>. \u00abThe threat actor escalated to root access, but weaponised the pam_rootok policy to seamlessly impersonate multiple low-privileged users to create a forensic smokescreen designed to confuse incident responders and establish a ‘hydra-like’ redundant persistence across unmonitored accounts.\u00bb The campaign is characterized by efforts to actively suppress system visibility by disabling logging services and removing authentication logs to blind standard file-based monitoring. The campaign was first observed in March 2026.\n <\/p>\n<\/p><\/div>\n<\/li>\n

  10. \n <\/p>\n
    \n Fake recruiter delivers stealer<\/span><\/p>\n

    \n Threat actors are masquerading as recruiters and trucking victims into installing a malicious application disguised as an AI meeting tool called Relay. The malware targets both macOS and Windows users, and attempts to steal sensitive data including browser credentials, wallet-related information, Keychain data, and Telegram sessions, per SlowMist<\/a>.\n <\/p>\n<\/p><\/div>\n<\/li>\n

  11. \n <\/p>\n
    \n 900,000 customers affected<\/span><\/p>\n

    \n Australian energy company Origin Energy said<\/a> it completed the initial phase of its review into a security incident that took place earlier this month, finding<\/a> that \u00abthe information of approximately 900,000 current and former customers was accessed.\u00bb The information accessed may include name, address, date of birth, phone number, last four digits of a credit card, or the BSB and last three digits of a bank account, and account details.\n <\/p>\n<\/p><\/div>\n<\/li>\n

  12. \n <\/p>\n
    \n Healthcare SaaS accounts targeted<\/span><\/p>\n

    \n Health-ISAC is warning of an increase in successful attacks conducted by ShinyHunters<\/a>. \u00abThe group appears to prioritize identity compromise and SaaS access over traditional ransomware deployment,\u00bb it said<\/a>. \u00abThe operational pattern described in recent incident reporting aligns to a repeatable chain: vishing (voice social engineering) \u2192 helpdesk\/MFA reset or device re-enrollment \u2192 Microsoft Entra (or Okta\/Google) SSO account takeover \u2192 pivot into connected SaaS platforms \u2192 rapid data exfiltration for extortion leverage. Even when victim statements indicate limited operational impact, the described tradecraft is the key defensive lesson. SSO is the control plane, and ShinyHunters’ leverage is created through data theft at cloud scale.\u00bb\n <\/p>\n<\/p><\/div>\n<\/li>\n

  13. \n <\/p>\n
    \n Supply chain defenses tightened<\/span><\/p>\n

    \n GitHub has laid out<\/a> the various steps it has taken to harden the supply chain at various stages and combat attacks that target weaknesses in package repositories and CI\/CD systems for malware propagation. Some of these include: (1) npm adding preventive account protection for high-impact accounts, (2) safer pull_request_target defaults for GitHub Actions checkout, (3) better controls over who and what triggers GitHub Actions workflows, (4) read-only Actions cache for untrusted triggers, (5) support for CircleCI in npm trusted publishing, (6) Action workflow network firewall, (7) staged publishing for npm, (8) default package cooldown for Dependabot version updates, (9) self-service credential revocation for incident response, and (10) expanded credential revocation API support.\n <\/p>\n<\/p><\/div>\n<\/li>\n

  14. \n <\/p>\n
    \n Seven critical Chrome flaws fixed<\/span><\/p>\n

    \n In an update released<\/a> on July 29, 2026, Google shipped patches to address 370 flaws in its Chrome browser, including seven that are rated critical in severity (from CVE-2026-17650 through CVE-2026-17656). Of these, 349 flaws were reported by Google itself, with the tech giant noting that the bugs were detected using AddressSanitizer, MemorySanitizer, UndefinedBehaviorSanitizer, Control Flow Integrity, libFuzzer, or AFL. None of the patched vulnerabilities have been flagged as actively exploited. The fixes are available in versions 151.0.7922.71\/.72 for Windows and Mac and 151.0.7922.71 for Linux. Google has addressed over 1,800 vulnerabilities in Chrome since the beginning of the year.\n <\/p>\n<\/p><\/div>\n<\/li>\n

  15. \n <\/p>\n
    \n Edge devices need forensic visibility<\/span><\/p>\n

    \n The U.K. National Cyber Security Centre (NCSC) has urged network device manufacturers to help incident response teams by making it easier to gather evidence after a compromise. \u00abForensic observability is particularly important for edge devices such as firewalls, VPN gateways and other network appliances,\u00bb NCSC said<\/a>. \u00abThese systems often sit at trust boundaries and are increasingly targeted by sophisticated threat actors. Forensic observability means giving defenders reliable ways to understand what a device is doing, what it has done and whether it can still be trusted after an incident. This includes telemetry, logging, configuration state, and the ability to collect forensic data from both memory and data at rest. Manufacturers should provide supported mechanisms for gathering the evidence needed to investigate incidents, assess impact, and restore trust in affected systems.\u00bb\n <\/p>\n<\/p><\/div>\n<\/li>\n

  16. \n <\/p>\n
    \n Phishing pages built in real time<\/span><\/p>\n

    \n Barracuda has revealed that LogoKit has evolved from a standard phishing kit into a \u00abreal-time deception platform\u00bb capable of building customized phishing pages for each victim. \u00abLogoKit has moved beyond static fake login pages, such as pre-built replicas of popular brands, to the creation and use of real-time, highly personalized phishing experiences,\u00bb it said<\/a>. \u00abThe platform uses legitimate commercial web services to recreate a victim’s corporate login experience, making phishing attacks more convincing and harder to detect. Every victim effectively receives a uniquely branded phishing page, making generic indicators of compromise harder to identify.\u00bb This involves capturing a real-time screenshot of the victim’s legitimate website and building phishing pages tailored to them. LogoKit uses the commercial Thum.io service to \u00abcreate full, legitimate website screenshots for the phishing background and Clearbit to add legitimate brand logos.\u00bb The attackers also rely on legitimate services, including Google Favicon, ImageKit and Microlink APIs, to dynamically load authentic logos and website imagery in real-time. LogoKit campaigns use phishing emails bearing warnings about passwords or delivery failures and timesheet updates to direct victims to the fake pages.\n <\/p>\n<\/p><\/div>\n<\/li>\n

  17. \n <\/p>\n
    \n Exploitation accelerates in 2026<\/span><\/p>\n

    \n A new analysis from VulnCheck has revealed that despite a significant uptick in vulnerability discovery and disclosure, 23.43% of known exploited vulnerabilities (KEVs) showed evidence of exploitation on or before the day the CVE was published. \u00abAt the same time, vulnerabilities appear to be being exploited faster, with the median time from CVE publication to KEV falling from 120 days in 2025 to 80 days during the first half of 2026,\u00bb VulnCheck said<\/a>. \u00abOf 1,061 vulnerabilities attributed to AI-assisted discovery, only 14, or 1.3%, have been confirmed as exploited in the wild, roughly matching the overall exploitation rate of all vulnerabilities in the first six months of the year.\u00bb The top technology categories being targeted by exploitation activity include CMS systems, network edge devices, operating systems, server software, and AI infrastructure (e.g., Langflow, Majordomo, lollms, LiteLLM, and dify).\n <\/p>\n<\/p><\/div>\n<\/li>\n

  18. \n <\/p>\n
    \n Credential stuffing hits SonicWall<\/span><\/p>\n

    \n An active, broad, and opportunistic credential stuffing campaign has been observed since July 25, 2026, resulting in successful unauthorized logins to SonicWall VPN and firewall accounts. To date, 92 unique user accounts across 30 organizations have been impacted. \u00abThe activity stems from five IPs and relies on infrastructure hosted on DigitalOcean to compromise numerous, seemingly unrelated organizations,\u00bb Huntress said<\/a>. \u00abCurrent telemetry indicates this is an automated credential validation attack, consistent with similar campaigns targeting SonicWall VPNs throughout 2025 and 2026.\u00bb\n <\/p>\n<\/p><\/div>\n<\/li>\n

  19. \n <\/p>\n
    \n Threat actors get new names<\/span><\/p>\n

    \n Google Threat Intelligence Group (GTIG) said<\/a> it will be rolling out a unified naming schema for tracking threat actors as part of its effort to standardize tracking across platforms and public reporting. \u00abThe new naming convention aligns with industry standard threat actor naming systems,\u00bb GTIG said. To that end, the new schema utilizes a cryptonym-based approach employing two-word combinations for each distinct threat actor, similar to those adopted by CrowdStrike (e.g., Mustang Panda) and Microsoft (e.g., Twill Typhoon). The first word is a term chosen to represent the specific actor, while the second word categorizes threat clusters by motivation, attribution, or activity type. Going forward, APT44 (aka Sandworm) will be referred to as Sandworm Relic, where Relic is the category name for threat actors of Russian origin. Similarly, those from China will be grouped under Castle, Iran under Ion, North Korea under Neptune, and cybercriminal gangs under Comet. GTIG said it will continue to use UNC (or uncategorized) for threat clusters that are still in the early stages of investigation.\n <\/p>\n<\/p><\/div>\n<\/li>\n

  20. \n <\/p>\n
    \n Hidden desktop hijacks sessions<\/span><\/p>\n

    \n A new remote access trojan (RAT) called MedusaHVNC is being sold as malware-as-a-service (MaaS), per BlackFog. The malware embeds a hidden virtual network computing (HVNC) module that opens a browser on a separate Windows desktop that’s out of sight of the victim. \u00abThe browser still runs on the victim’s device, so it can load an existing profile, including cookies and session state,\u00bb BlackFog said<\/a>. \u00abThis gives the operator access to live, logged-in sessions while the activity continues to come from the victim’s usual machine.\u00bb The seller lists Chrome, Edge, Brave, Firefox, and Telegram as supported applications. The malware uses a 5-stage infection chain. It begins when the legitimate \u00abwscript.exe\u00bb binary executes a JavaScript launcher, which then sets off the subsequent steps, including dropping additional payloads and using AutoIT to decrypt and launch MedusaHVNC, which then communicates with an external server to exfiltrate data.\n <\/p>\n<\/p><\/div>\n<\/li>\n

  21. \n <\/p>\n
    \n DNS hijack exposed credentials<\/span><\/p>\n

    \n CubePilot has announced an operational disruption stemming from a DNS hijacking attack. Unknown threat actors are said to have gained control of the cubepilot[.]org domain DNS settings on July 24, allowing them to intercept traffic intended for internal systems. The threat actors also obtained TLS certificates covering all cubepilot.org subdomains. \u00abThe certificates obtained by the attacker covered every cubepilot.org subdomain, so credentials entered on any of our services on 24 July may have been captured – the portal and the forum included,\u00bb CubePilot said<\/a>. \u00abIf you used the same password anywhere else, change it there now.\u00bb CubePilot has since regained control of its domains and revoked the fraudulently issued certificates.\n <\/p>\n<\/p><\/div>\n<\/li>\n

  22. \n <\/p>\n
    \n Spear-phishing delivers SpyGlace<\/span><\/p>\n

    \n The threat actor known as APT-C-60 has continued to target Japanese organizations with spear-phishing emails to deliver SpyGlace malware. \u00abWhile several changes have been identified, such as a shift in infrastructure from Bitbucket to GitHub and updates to the malware itself, many characteristics remain consistent, including the abuse of legitimate services and the behavior of the malware,\u00bb JPCERT\/CC said<\/a> late last year. As of 2026, the spear-phishing emails contain a Proton Drive link to trick recipients into downloading a RAR archive containing a LNK file, which then deploys SpyGlace by downloading an intermediate payload from jsDelivr. \u00abBy using legitimate services, the threat actor may be attempting to make communications and downloads appear to be normal access,\u00bb JPCERT\/CC said<\/a>.\n <\/p>\n<\/p><\/div>\n<\/li>\n

  23. \n <\/p>\n
    \n AI agent validates exploitable flaws<\/span><\/p>\n

    \n Google has launched a preview of CodeMender, an AI agent designed to scan codebases for security flaws, confirm they are exploitable and eliminate false positives, and generate fixes for developers to review. The tool supports C\/C++, Go, Java, Python, Ruby, Rust, and TypeScript. \u00abThe agent goes beyond static code-pattern analysis by simulating an attack with exploit code it builds and runs in an isolated, customer-managed sandbox,\u00bb Google said<\/a>. \u00abThe agent uses this proof-of-concept exploit to verify that the security flaw poses a legitimate risk. This critical verification phase allows your security practitioners and developers to prioritize validated risks by eliminating false positives.\u00bb CodeMender will add support for third-party frontier models later this year.\n <\/p>\n<\/p><\/div>\n<\/li>\n

  24. \n <\/p>\n
    \n 4,340 extremist URLs flagged<\/span><\/p>\n

    \n Europol said it supported an action targeting nihilistic violent extremist content online between June and July 2026 with an aim to disrupt The Com online ecosystem and restrict propaganda dissemination. The agency and its partners have flagged 4,340 \u00abhorrific\u00bb URLs linked to The Com for removal. Belgium, Finland, Hungary, Ireland, Luxembourg, Netherlands, Portugal, Spain, and Sweden participated in the effort. \u00abGroups affiliated with The Com recruit members and groom victims on social media, messaging apps, and gaming platforms to engage in self-harm, animal torture, violent attacks, and the production of child sexual abuse material,\u00bb Europol said<\/a>. \u00abThey distribute propaganda on accessible platforms to attract young individuals, funnelling potential members and victims into private forums and chat rooms where radicalisation and victimisation occur. Victims are typically coerced into remaining under the perpetrators’ influence through (s)extortion.\u00bb Members of the loose-knit collective also participate in cybercrime, extortion, doxxing, swatting, real-life shootings, stabbings, and other physical violence.\n <\/p>\n<\/p><\/div>\n<\/li>\n

  25. \n <\/p>\n
    \n Fake games deliver Amatera<\/span><\/p>\n

    \n Fake downloads of games, mods, cracks, and software are being used to spread RenPy Loader (aka RenEngine Loader). \u00abOnce installed, the loader starts a complex, multi-stage infection chain that abuses MSBuild and the EtherHiding technique before ultimately delivering Amatera Stealer,\u00bb Malwarebytes said<\/a>. \u00abRenPy Loader has also been observed delivering other malware, including Hijack Loader and Lumma Stealer, showing that the final payload can vary between campaigns.\u00bb\n <\/p>\n<\/p><\/div>\n<\/li>\n<\/ol>\n<\/section>\n<\/div>\n

    Most failures stay quiet until someone relies on them.<\/p>\n

    A login works. A partner is trusted. A tool behaves as expected. Then one assumption turns out to be doing all the security work.<\/p>\n

    That is the part worth checking before next week finds it first.<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

    \ue804Ravie Lakshmanan\ue802Jul 30, 2026Hacking News \/ Cybersecurity News A lot of security still comes down to trusting the wrong screen. This week, that screen might be a login page, an…<\/p>\n","protected":false},"author":1,"featured_media":2116,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[189,24,182,1112,11,2295,1014,2538,187],"class_list":["post-2115","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-aipowered","tag-attacks","tag-chrome","tag-dns","tag-flaws","tag-hacking","tag-hijacking","tag-sonicwall","tag-stories"],"_links":{"self":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/2115","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2115"}],"version-history":[{"count":0,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/2115\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/media\/2116"}],"wp:attachment":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2115"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2115"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2115"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}